CVE-2018-15676

BTITeam XBTIT has a cross-site scripting vulnerability (CVE-2018-15676). The root cause is the use of String.replace and eval, which bypasses the anti-XSS mechanism in includes/crk_protection.php and allows injection/execution of arbitrary JavaScript. The reports describe the vulnerability and ex...

CVE-2018-15676

An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crkprotection.php anti-XSS mechanism that looks for a number of dangerous fingerprints...

CVE-2018-15678

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

CVE-2018-15680

CVE-2018-15680 affects BTITeam XBTIT 2.5.4 where passwords in the xbtit_users table are stored as unsalted MD5 hashes. The root cause is weak password hashing, enabling context-dependent attackers to brute-force and recover cleartext passwords. Public details in the provided documents confirm the...

Xbtit 2.0.0 - SQL Injection Vulnerability

No description provided by source. Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File : /index.php?page=users&order=SQL&by=ASC ExploiT :...

xBtiTracker - SQL Injection

xBtiTracker - SQL Injection Exploit Title: xBtiTracker Remote SQL Injection Vulnerability Date: 10.04.2010 Author: InATeam http://inattack.ru/ via Dominus Software Link: http://www.btiteam.org/ Version: xbtit v.2.0.0 - revision 559 and older Tested on: xbtit v.2.0.0 - revision 559 Code :...

xBtiTracker - SQL Injection

Exploit Title: xBtiTracker Remote SQL Injection Vulnerability Date: 10.04.2010 Author: InATeam http://inattack.ru/ via Dominus Software Link: http://www.btiteam.org/ Version: xbtit v.2.0.0 - revision 559 and older Tested on: xbtit v.2.0.0 - revision 559 Code :...

Xbtit 2.0.0 SQL Injection

Exploit Title: Xbtit SQL Injection Vulnerability Date: 14.03.2010 Author: Ctacok Software Link: http://xbtit.com/ Version: 2.0.0 Tested on: Windows XP SP3 Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File : /index.php?page=users&order=SQL&by=AS...

Xbtit v2.0.0 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================== Xbtit v2.0.0 SQL Injection Vulnerability ======================================== Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File :...

Xbtit 2.0.0 - SQL Injection

Xbtit 2.0.0 - SQL Injection Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File : /index.php?page=users&order=SQL&by=ASC ExploiT :...

Xbtit 2.0.0 - SQL Injection

Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File : /index.php?page=users&order=SQL&by=ASC ExploiT :...

xbtit-sql.txt

. . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z -beenu- DON -OutLawz- P47tr1ck- FeDeReR- MAGE- JeTFyrE-FunctionSys-jappan and all...

BtiTracker/xbtit 'scrape.php' SQL注入漏洞

BUGTRAQ ID: 30811 CNCAN ID：CNCAN-2008082601 BtiTracker/xbtit是一款基于PHP的WEB应用程序。 BtiTracker/xbtit不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'scrape.php'脚本对用户提交给'infohash'变量缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 BtiTeam xbtit 2.0.542 BtiTeam xbtit 2.0 BtiTeam BtiTracker 1.4.7 BtiTe...

btitrackerxbtit-sql.txt

SQL Injection Vulnerability in BtiTracker and xbtit Vulnerable products BtiTracker =1.4.7 https://sourceforge.net/projects/btit-tracker/ xbtit =2.0.542 http://www.btiteam.org Description A vulnerability is caused due to the application does not perform sanitation checks for input passed to the...